From 9a97284ca18cab908d4f263483bf4d696a9f5355 Mon Sep 17 00:00:00 2001
From: Gabe <gabe@gabesville.com>
Date: Sun, 13 Sep 2026 04:21:44 +0000
Subject: [PATCH] Add Security_Containers/authelia/compose.yaml

---
 Security_Containers/authelia/compose.yaml | 42 +++++++++++++++++++++++
 1 file changed, 42 insertions(+)
 create mode 100644 Security_Containers/authelia/compose.yaml

diff --git a/Security_Containers/authelia/compose.yaml b/Security_Containers/authelia/compose.yaml
new file mode 100644
index 0000000..142af96
--- /dev/null
+++ b/Security_Containers/authelia/compose.yaml
@@ -0,0 +1,42 @@
+services:
+  authelia:
+    image: authelia/authelia:latest
+    container_name: ${SERVICE_NAME}
+    restart: unless-stopped
+    networks:
+      - traefik_network
+    volumes:
+      - ./config:/config
+    secrets:
+      - authelia_jwt_secret
+      - authelia_session_secret
+      - authelia_storage_encryption_key
+    environment:
+      - TZ=${TZ:-America/Chicago}
+      - AUTHELIA_JWT_SECRET_FILE=/run/secrets/authelia_jwt_secret
+      - AUTHELIA_SESSION_SECRET_FILE=/run/secrets/authelia_session_secret
+      - AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE=/run/secrets/authelia_storage_encryption_key
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik_network"
+      # Portal router - serves the login UI itself
+      - "traefik.http.routers.${SERVICE_NAME}.rule=Host(`auth.${DOMAIN_NAME}`)"
+      - "traefik.http.routers.${SERVICE_NAME}.entrypoints=websecure"
+      - "traefik.http.routers.${SERVICE_NAME}.tls.certresolver=cloudflare"
+      - "traefik.http.services.${SERVICE_NAME}.loadbalancer.server.port=9091"
+      # ForwardAuth middleware - attach this to any OTHER router you want gated
+      - "traefik.http.middlewares.authelia.forwardauth.address=http://${SERVICE_NAME}:9091/api/verify?rd=https://auth.${DOMAIN_NAME}"
+      - "traefik.http.middlewares.authelia.forwardauth.trustForwardHeader=true"
+      - "traefik.http.middlewares.authelia.forwardauth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email"
+
+networks:
+  traefik_network:
+    external: true
+
+secrets:
+  authelia_jwt_secret:
+    file: ./secrets/jwt_secret
+  authelia_session_secret:
+    file: ./secrets/session_secret
+  authelia_storage_encryption_key:
+    file: ./secrets/storage_encryption_key
\ No newline at end of file